6b0a9042919243dbd7e2f81c2ba38f1a5f3dfc5fbbecf9e3d5a0c21244893e62 | Triage

Sharing

General

Target

3f43b9396551277894edec9387907d50_JaffaCakes118
Size

231KB
Sample

241013-l82yqs1dlb
MD5

3f43b9396551277894edec9387907d50
SHA1

34e98b4f6d80ca68a4abae365524f8c9c64f8cce
SHA256

6b0a9042919243dbd7e2f81c2ba38f1a5f3dfc5fbbecf9e3d5a0c21244893e62
SHA512

0f2fadf026c23d96263a18c5237b9f9d4ac3fb3ff2ae0db4df7e0a7d11f5220d8e4b6bec42697b53177aedaa14eced1352efa56d544e432dd0affa3dcb601636
SSDEEP

3072:AcKmbKLz5qdjmoLO0rzUd7OmGvXjW6BWHo6X6mnfWWI+PuWdpnWpo1d3/1975llM:AcKmbKLleA5LW697FswfdTyjV1

Score

9^/10

defense_evasion discovery evasion exploit ransomware

Malware Config

Targets

- Target
  
  3f43b9396551277894edec9387907d50_JaffaCakes118
- Size
  
  231KB
- MD5
  
  3f43b9396551277894edec9387907d50
- SHA1
  
  34e98b4f6d80ca68a4abae365524f8c9c64f8cce
- SHA256
  
  6b0a9042919243dbd7e2f81c2ba38f1a5f3dfc5fbbecf9e3d5a0c21244893e62
- SHA512
  
  0f2fadf026c23d96263a18c5237b9f9d4ac3fb3ff2ae0db4df7e0a7d11f5220d8e4b6bec42697b53177aedaa14eced1352efa56d544e432dd0affa3dcb601636
- SSDEEP
  
  3072:AcKmbKLz5qdjmoLO0rzUd7OmGvXjW6BWHo6X6mnfWWI+PuWdpnWpo1d3/1975llM:AcKmbKLleA5LW697FswfdTyjV1
Score

9^/10

defense_evasion discovery evasion exploit ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Drops file in Drivers directory
- Possible privilege escalation attempt
  exploit
- Executes dropped EXE
- Modifies file permissions
  discovery
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

Windows File and Directory Permissions Modification

Hide Artifacts

Hidden Files and Directories

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

defense_evasiondiscoveryevasionexploitransomware

behavioral2